Ethereal-users: Re: [Ethereal-users] help with trace

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Bill Meier" <wmeier@xxxxxxxxxxx>
Date: Fri, 07 Oct 2005 18:39:17 -0500
> What I don't understand 504-513, the packet stream is ok up until this point, 
> but to me 504 is an > ak to a frame that does not exist? 
> Then 512 starts, like there was of several frames in a 
> segment? Is this correct?

I can think of various reasons for the pattern shown, but they boil down to 
the capture not including (for some reason) all the actual frames of the tcp connection.

The tcp connection appears to be going along just fine (since, for example,  
over the the almost 500 millsec time gap the sequence numbers 
from port 21325 increased by  more than the window size advertised by port 2193).

So: how was this capture made ? Was the capture done on one of  the end-point
nodes of the tcp session ?


Bill Meier